The 'chalice gen-policy' output should include logs:* permissions
- Dominant language
- Python
- Stars
- 11.1k
- Forks
- 1k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 2
Description
Hi,
It might not be a bug but it caused me a lot of headaches.
I had to create a policy file manually using `chalice gen-policy` some weeks ago to overcome another issue ( #1198).
It wasn't apparent right after I've deployed the API with `chalice deploy --no-autogen-policy` that the API does not write any logs, regardless I was using `python/logging` package, the default `app.log.*` or `print()` statements. I wasted long hours trying to find a workaround until I found out that there must be something about the API (Lambda) permissions.
It is so trivial, the logging permission section is completely missing from the output of `chalice gen-policy`
Adding this to my manual policy solved my issue.
```json
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:*"
},
```
It would be nice if the `chalice gen-policy` would provide all required/default permissions, and thus we could select which we need to include in our manual policy.
Thanks
Contributor guide
Research direction
Start at the `chalice gen-policy` command and inspect how its generated policy is assembled. Verify the output against the logging permissions described in the issue, including `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents`; done means the generated policy includes the required logging permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100